- 17 2月, 2011 1 次提交
-
-
由 Florian Westphal 提交于
Assigning a socket in timewait state to skb->sk can trigger kernel oops, e.g. in nfnetlink_log, which does: if (skb->sk) { read_lock_bh(&skb->sk->sk_callback_lock); if (skb->sk->sk_socket && skb->sk->sk_socket->file) ... in the timewait case, accessing sk->sk_callback_lock and sk->sk_socket is invalid. Either all of these spots will need to add a test for sk->sk_state != TCP_TIME_WAIT, or xt_TPROXY must not assign a timewait socket to skb->sk. This does the latter. If a TW socket is found, assign the tproxy nfmark, but skip the skb->sk assignment, thus mimicking behaviour of a '-m socket .. -j MARK/ACCEPT' re-routing rule. The 'SYN to TW socket' case is left unchanged -- we try to redirect to the listener socket. Cc: Balazs Scheidler <bazsi@balabit.hu> Cc: KOVACS Krisztian <hidden@balabit.hu> Signed-off-by: NFlorian Westphal <fwestphal@astaro.com> Signed-off-by: NPatrick McHardy <kaber@trash.net>
-
- 21 10月, 2010 3 次提交
-
-
由 Balazs Scheidler 提交于
Signed-off-by: NBalazs Scheidler <bazsi@balabit.hu> Signed-off-by: NKOVACS Krisztian <hidden@balabit.hu> Signed-off-by: NPatrick McHardy <kaber@trash.net>
-
由 Balazs Scheidler 提交于
Also, inline this function as the lookup_type is always a literal and inlining removes branches performed at runtime. Signed-off-by: NBalazs Scheidler <bazsi@balabit.hu> Signed-off-by: NKOVACS Krisztian <hidden@balabit.hu> Signed-off-by: NPatrick McHardy <kaber@trash.net>
-
由 Balazs Scheidler 提交于
Without tproxy redirections an incoming SYN kicks out conflicting TIME_WAIT sockets, in order to handle clients that reuse ports within the TIME_WAIT period. The same mechanism didn't work in case TProxy is involved in finding the proper socket, as the time_wait processing code looked up the listening socket assuming that the listener addr/port matches those of the established connection. This is not the case with TProxy as the listener addr/port is possibly changed with the tproxy rule. Signed-off-by: NBalazs Scheidler <bazsi@balabit.hu> Signed-off-by: NKOVACS Krisztian <hidden@balabit.hu> Signed-off-by: NPatrick McHardy <kaber@trash.net>
-
- 08 10月, 2008 1 次提交
-
-
由 KOVACS Krisztian 提交于
The iptables tproxy core is a module that contains the common routines used by various tproxy related modules (TPROXY target and socket match) Signed-off-by: NKOVACS Krisztian <hidden@sch.bme.hu> Signed-off-by: NPatrick McHardy <kaber@trash.net>
-